SPF Record Validator

What Is SPF?

SPF (Sender Policy Framework) is a DNS-based email authentication protocol that specifies which mail servers are authorized to send email on behalf of your domain. It works by publishing a TXT record in your domain's DNS zone that lists approved sending IP addresses and hostnames. When a receiving mail server gets an email claiming to be from your domain, it performs a DNS lookup to retrieve your SPF record and checks whether the sending server's IP address is authorized. If the IP is not listed, the receiving server can reject the message, mark it as spam, or let it through depending on the qualifier specified in the record.

SPF was originally defined in RFC 4408 and later updated by RFC 7208. It is one of three core email authentication protocols alongside DMARC and DKIM. Together, these protocols form a defense-in-depth strategy that protects your domain from phishing, spoofing, and business email compromise (BEC) attacks.

How SPF Records Work

An SPF record is a single DNS TXT record published at your domain's root. When a receiving server processes an inbound email, it extracts the envelope sender domain (the Return-Path or MAIL FROM address), queries DNS for a TXT record starting with v=spf1, and evaluates the mechanisms in order from left to right until one matches the sending server's IP address.

SPF Record Syntax

Every SPF record begins with the version tag v=spf1 followed by one or more mechanisms and a final all catch-all. Here is an example:

v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:sendgrid.net -all

SPF Mechanisms

• ip4 / ip6 — authorize specific IP addresses or CIDR ranges. These do not count toward the DNS lookup limit.
• include — delegates authorization to another domain's SPF record. Each include triggers an additional DNS lookup.
• a — matches the domain's A or AAAA record IP addresses.
• mx — matches the IP addresses of the domain's MX (mail exchanger) records.
• redirect — replaces the current SPF evaluation with another domain's SPF record.
• all — the catch-all mechanism that matches everything not matched by previous mechanisms.

SPF Qualifiers

Each mechanism can be prefixed with a qualifier that determines how the receiving server should handle a match:

• + (Pass) — the default qualifier. The sending server is authorized. Usually omitted because it is implied.
• - (Hard Fail) — the sending server is not authorized. Receivers should reject the message. Recommended for production domains.
• ~ (Soft Fail) — the sending server is probably not authorized. Receivers should accept but flag the message. Common during initial rollout.
• ? (Neutral) — the domain makes no assertion about the sending server. Effectively the same as having no SPF record for that mechanism.

For maximum protection, use -all (hard fail) at the end of your SPF record. This tells receivers to reject any email from servers not explicitly listed in your record.

The 10 DNS Lookup Limit

RFC 7208 imposes a hard limit of 10 DNS lookups per SPF evaluation. This limit exists to prevent denial-of-service attacks where a maliciously crafted SPF record could force a receiving server into an excessive number of DNS queries. Each of the following mechanisms counts as one lookup: include, a, mx, redirect, and exists. Nested includes within included records also count toward the total.

Exceeding 10 lookups causes a PermError, which many receiving servers treat as a complete SPF failure. This is the single most common SPF misconfiguration and particularly affects organizations that use multiple SaaS email services.

Strategies to Reduce DNS Lookups

• Flatten your SPF record — resolve include chains to their underlying IP addresses and use ip4 / ip6 mechanisms directly. These do not count toward the lookup limit.
• Remove unused includes — audit your SPF record regularly and remove includes for services you no longer use.
• Consolidate services — where possible, use fewer email sending services to reduce the number of required includes.
• Avoid the mx and a mechanisms — these each trigger a lookup. If your mail server IPs are static, use ip4 instead.
• Use subdomains for bulk mail — send transactional or marketing email from a subdomain with its own SPF record to keep the root domain's record lean.

Common SPF Problems and Fixes

SPF and Email Deliverability

SPF directly impacts whether your emails reach the inbox or land in spam. Major email providers including Gmail, Outlook, and Yahoo evaluate SPF results as part of their spam filtering algorithms. A passing SPF result builds sender reputation over time, improving overall deliverability rates. Conversely, SPF failures can trigger spam filtering even for legitimate messages.

However, SPF alone is not sufficient for reliable email delivery. SPF only validates the envelope sender (Return-Path), not the visible From header that users see. This gap allows sophisticated spoofing attacks where the From header shows your domain even though the envelope sender is different.

For complete protection, SPF should be deployed alongside DKIM (which cryptographically signs message content) and DMARC (which ties SPF and DKIM together with a domain-level policy). This three-layer authentication chain is now a baseline requirement for email deliverability. For a comprehensive guide on deploying all three, read our SPF, DKIM, and DMARC setup guide.

Common SPF Includes for Popular Services

If you send email through any of these services, add the corresponding include mechanism to your SPF record:

How This SPF Validator Works

When you enter a domain above, our SPF record validator performs a comprehensive analysis of your SPF configuration:

• Record retrieval — queries your domain's DNS TXT records and identifies the SPF record.
• Syntax validation — parses every mechanism, qualifier, and modifier to confirm the record follows RFC 7208 syntax rules.
• DNS lookup counting — recursively resolves all include chains and counts the total DNS lookups, flagging records that exceed or approach the 10-lookup limit.
• Qualifier strength check — verifies that your all mechanism uses a hard fail (-all) for maximum protection.
• Misconfiguration detection — identifies common issues such as multiple SPF records, overly permissive policies, deprecated mechanisms, and missing includes for known email services.
• Actionable remediation — provides specific, step-by-step instructions to fix every issue found.

For a broader view of your domain's email security posture, run a DNS security check or use our full infrastructure scan to evaluate SPF alongside DKIM, DMARC, DNSSEC, SSL/TLS, security headers, and more.

Frequently Asked Questions